Juniper Apstra provides four system-defined user roles that are available in the Apstra GUI

environment. They are: administrator, device_ztp, viewer, and user1. Based on the web search

results, we can infer the following statements:

viewer: This role includes permissions to only view various elements in the Apstra system, such as

blueprints, devices, design, resources, external systems, platform, and others. Users with this role

cannot create, edit, or delete any element12.

user: This role includes permissions to view and edit various elements in the Apstra system, such as

blueprints, devices, design, resources, external systems, platform, and others. Users with this role

cannot create or delete any element12.

authorized: This is not a system-defined user role in Juniper Apstra. It is a term used to describe users

who have been authenticated by an external system, such as LDAP, Active Directory, TACACS+, or

RADIUS3.

root: This is not a system-defined user role in Juniper Apstra. It is a term used to describe the

superuser account on a Linux system, which has full access to all commands and files. Creating a user

in the Apstra GUI does not provide that user access to the Apstra platform via SSH. To access the

Apstra platform via SSH, you must create a local Linux system user4. Reference:

User / Role Management Introduction

User/Role Management (Platform)

AAA Providers

User Profile Management

In Juniper Apstra, resources such as Autonomous System (AS) numbers, IP addresses, and VLAN IDs are managed within pools. These resource pools can be defined with two distinct scopes. They can be created at a global level, making them available for assignment across all blueprints managed by the Apstra controller. Alternatively, a resource pool can be created within a specific blueprint, limiting its scope and usage to only that blueprint. This provides flexibility for both shared resource management and blueprint-specific allocations.

A. User-defined resources are supported.

While this statement is true, it is less precise than option C, which correctly describes the fundamental scoping mechanism for all resource pools, whether default or user-defined.

B. The scope of a pool is limited to a single blueprint.

This is incorrect. Resource pools can also be defined at the global level, making them available to all blueprints.

D. Only the default resources are supported globally.

This is incorrect. Users can create their own custom resource pools at the global level, not just use the default ones.

1. Juniper Apstra User Guide, "Resource Pools". This section explicitly states, "You can create resource pools at the global level (Design > Global) or at the blueprint level (Staged > Blueprint > Resources)."

2. Juniper TechLibrary, "Apstra Resource Management". The documentation details the hierarchy and scope of resource pools, confirming that pools can be either global or blueprint-specific.

Juniper Apstra's ability to scale and manage thousands of devices stems from its core architecture as a distributed state system. Apstra maintains a "single source of truth" for the intended state of the entire network. However, the collection of operational state (telemetry) and the rendering of device configurations are distributed tasks handled by agents running on the network devices themselves. This distributed model avoids overwhelming the central Apstra controller with constant polling and low-level configuration tasks for every device. The controller manages the high-level intent, while the distributed components handle the real-time validation and implementation, enabling massive scale.

A. Apstra can be installed in various environments, including the cloud, but the installation location itself is not the architectural reason for its scalability.

B. NGINX is a web server used for the Apstra UI. It is a component of the system but not the core architectural principle that enables network management scalability.

C. An OVA (Open Virtualization Appliance) is a software packaging and deployment format. It simplifies installation but does not define the internal architecture responsible for scalability.

1. Juniper Networks White Paper, "Apstra: Intent-Based Networking for the Data Center". This paper describes Apstra's architecture, stating, "Apstra software is a distributed system that is constantly comparing the intent with the operational state of the network." It emphasizes the role of distributed agents in collecting telemetry, which is key to scaling.

2. Juniper Apstra Product Documentation, "Apstra System Architecture Overview". The documentation explains the roles of the Apstra server (controller) and the device agents. It highlights that agents perform local data collection and processing, which offloads the central server and allows the system to scale efficiently.

In Juniper Apstra, a Logical Device is an abstract model representing a network device's capabilities, such as the number and speed of its ports. When creating a logical device, you must assign it a role that defines its function within a fabric topology. The primary roles available for devices that form the fabric are Spine and Leaf, corresponding to a Clos architecture. The Generic role is used for devices that connect to the fabric but are not part of the spine-leaf topology, such as external routers or firewalls.

B. Empty: "Empty" is not a recognized role for a logical device in Apstra's design templates. It does not represent a functional component of the fabric.

E. Root: "Root" is a term associated with Spanning Tree Protocol (STP) for loop prevention in Layer 2 networks, not a device role within an Apstra EVPN-VXLAN fabric design.

1. Juniper Apstra User Guide, Section: Design > Logical Devices. The documentation explicitly lists the available roles when creating a logical device. The options include Leaf, Spine, and Generic.

2. Juniper Networks (2021), Apstra Fabric Conductor Administration Guide, Release 4.0. In the section on creating logical devices, the guide states, "Select a role for the device (Spine, Leaf, or Generic)."

When a predefined interface map is modified in the Juniper Apstra global catalog, two key things occur. First, this change does not retroactively affect blueprints that have already imported that map. Blueprints maintain their own local catalog, which contains a copy of the interface map as it existed at the time of import. Second, modifying predefined, vendor-supplied elements is not a supported practice. During a software upgrade, the Apstra system will overwrite any user modifications to these predefined elements with the new default versions included in the upgrade package to ensure system integrity and compatibility.

C. Changes made to predefined interface maps can have a significant negative impact, potentially causing unpredictable behavior or failures during software upgrades.

D. Anomalies are generated based on a mismatch between a blueprint's intent and the operational state. A change in the global catalog does not alter a blueprint's intent.

1. Juniper Apstra 4.2 User Guide, "Design" Section: The guide explains that design elements like Interface Maps are stored in a global catalog and can be imported into a blueprint's local catalog. This architecture implies that once imported, the blueprint's version is independent of the global source. (This concept is fundamental to Apstra's blueprint architecture).

2. Juniper Apstra 4.2 Installation and Upgrade Guide, "Upgrading Apstra Controller" Section: Under the "Important" notes for upgrading, the documentation explicitly states: "Modifying predefined elements (for example, rack types, templates, device profiles) is not supported. If you have modified predefined elements, they will be overwritten during the upgrade process." This directly supports the statement that changes are discarded upon upgrade.